We help you bring your company into line with Regulation (EU) 2024/1689: inventory and classification of your AI systems by risk level, transparency obligations, governance and human oversight. The Regulation already applies in phases, the AESIA is already inspecting in Spain and penalties reach €35 million or 7% of turnover. We tell you what to comply with and when, with the calendar updated after the Digital Omnibus.
Free consultation
We reply within 24 hours
Six building blocks to move from “we use AI with no oversight” to supervised, documented use that you can defend before the AESIA and that follows the Regulation’s risk-based approach.
We identify every AI system your organization uses or develops—including the AI your employees use on their own and autonomous agents—along with its purpose and the data it processes. Without an inventory, there is no way to show compliance.
We classify each system into the AI Act’s four levels—unacceptable (prohibited), high risk, limited risk or minimal risk—because the obligations that apply to you and the deadlines you must meet depend on that category.
We design the AI use policy, the roles, effective human oversight and risk management. The Regulation does not require an “AI officer,” but it does require people with enough knowledge to oversee AI.
The Article 50 transparency obligations (telling people they are interacting with AI and marking generated or manipulated content, including deepfakes) have applied since August 2, 2026. We help you implement them.
AI and the GDPR go hand in hand: the AESIA and the AEPD (Spanish Data Protection Agency) share responsibilities. We align your use of AI with legal bases for processing, information to data subjects, biometrics and the role of the Data Protection Officer.
If you use AI in recruitment, credit scoring, biometrics or education, it is probably high risk. We prepare the technical documentation, registration, oversight and conformity assessment ahead of the new dates.
The AI Act does not regulate only those who build AI: it affects any EU company that develops, markets or simply uses AI systems in its business, even if the tool comes from a third party. The AESIA is already inspecting in Spain.
"If you use AI in your business you are a ‘deployer’ and you have obligations, even if someone else built the tool. And the company is answerable even for the AI its employees use on their own."
"Providers bear the most demanding obligations, above all for high-risk systems: risk management, data, technical documentation, registration, human oversight and conformity assessment."
"Recruitment, credit scoring, biometrics, education and access to essential services are high-risk uses (Annex III) with enhanced obligations, although their dates have been postponed by the Digital Omnibus."
"If you use ChatGPT, Gemini or other generative AI, the main obligations fall on the model provider. Yours is transparency: telling people when content is AI-generated and, if you use it in a high-risk context, complying as a deployer."
The AI Act’s penalty regime exceeds the GDPR’s in amount. And the AESIA can act on its own initiative, without needing a prior complaint. For many companies the biggest risk is not even knowing which AI they are using.
Using prohibited AI (subliminal manipulation, social scoring, certain biometric uses or sexual deepfakes) is penalized with up to €35,000,000 or 7% of annual worldwide turnover, whichever is higher.
Breaching the obligations for high-risk systems or the transparency obligations can cost up to €15,000,000 or 3% of turnover. Giving false information to the authority can cost up to €7.5 million or 1%.
Failing to inventory or classify: if you cannot show which AI systems you use, for what purpose and under what controls, you will not be able to demonstrate compliance. As under the GDPR, the burden of proof is on your organization.
Not labeling AI content: since August 2026 you must disclose interaction with AI and mark synthetic content. Failing to do so is an infringement, especially sensitive for media, marketing and platforms.
Liability for your employees: the company answers for the AI use of its staff, even if it was not authorized. “I didn’t know” does not excuse non-compliance.
The Spanish Artificial Intelligence Supervisory Agency has been operational since February 2025, with its own inspection corps and power to impose penalties for prohibited practices. It can issue warnings and act on its own initiative.
We build the inventory, classify your systems by risk level and tell you exactly what to comply with and by when, with the calendar updated after the Digital Omnibus. Starting now is cheap; doing it under an inspection is expensive.
The AI Act is Regulation (EU) 2024/1689, the world’s first comprehensive AI law. It applies to any company that develops, markets or uses AI systems in the European Union, even if the tool comes from a third party. It sorts systems into four risk levels with proportionate obligations.
Yes, in phases. The prohibitions and AI literacy have applied since February 2025; the rules for general-purpose models and the penalty regime, since August 2025; and the Article 50 transparency obligations, since August 2, 2026.
The Digital Omnibus (agreement of May 2026) has postponed the high-risk obligations: those under Annex III to December 2027, and those under Annex I to August 2028. These new deadlines take effect once formally published.
Three tiers: using prohibited AI, up to €35,000,000 or 7% of worldwide turnover; breaching high-risk or transparency obligations, up to €15,000,000 or 3%; and false information to the authority, up to €7.5 million or 1%. For SMEs and startups the lower figure applies, but there is no full exemption.
ChatGPT is a general-purpose AI (GPAI) model: the main obligations fall on its provider. Yours is transparency: if you generate content that is presented as human, you must disclose it. And if you use it in a high-risk context (evaluating employees, credit decisions), those enhanced obligations apply to you as the deployer.
Systems whose use can affect rights or safety: recruitment, employee evaluation, credit scoring, biometrics, education, access to essential services or AI built into regulated products. They involve risk management, technical documentation, registration, human oversight and conformity assessment.
You are still the deployer and have obligations of your own: use it according to its instructions, ensure human oversight, inform affected people where appropriate and monitor how it performs. Ignorance is no excuse: if your HR or credit software includes high-risk AI, the urgent step is to classify it.
The AI Act does not require a role equivalent to the Data Protection Officer. It does require people with enough knowledge to oversee the systems (AI literacy) and, for high risk, effective human oversight. In practice, it makes sense to assign clear responsibilities within compliance.
The Spanish Artificial Intelligence Supervisory Agency (AESIA), based in A Coruña, is the AI market surveillance authority in Spain and the point of contact with the EU AI Office. It can inspect, require documentation, order non-compliant systems to be withdrawn and conduct penalty proceedings, including on its own initiative.
Only in part, and the nuance matters. It postpones the high-risk obligations (Annex III to December 2027; Annex I to August 2028), but not the prohibitions, the general-purpose model rules or Article 50 transparency, which stays at August 2, 2026. And it adds new prohibitions on sexual deepfakes taking effect in December 2026.
Yes. The organization is responsible for the AI used in its business, including what employees use on their own (so-called “shadow AI”) and the agents deployed internally. That is why the inventory must also cover the AI that is off the radar today.
They overlap. Many AI systems process personal data, so the AI Act has to be coordinated with the GDPR and with the Data Protection Officer. In Spain, the AESIA and the AEPD share competences: the AEPD keeps its role on data and biometrics.
Yes. Since August 2026 you must disclose interaction with AI and mark synthetic content (text, image, audio and video), with specific machine-readable marking obligations for providers from December 2026. It hits media, marketing, agencies and platforms squarely.
Yes, with caveats. There is simplified documentation, proportionate penalties and access to the AESIA regulatory sandbox to test high-risk systems in a supervised environment. The Omnibus extends some of those facilities to “small mid-caps.” But no company is fully exempt.
On its way. In May 2026 the Government approved the bill for an Organic Law on AI governance, which adapts the Regulation to Spanish law and sets national authorities and penalties. It is still going through Parliament, but the substantive obligations are already enforceable through the EU regulation: there is no need to wait for the law to get started.
The AI Act is risk-based legislation: the higher the risk of the use, the more obligations. Classifying each system correctly is the step that determines everything else. Here is the picture, with the calendar already adjusted for the Digital Omnibus.
Obligations, deadlines and penalties depend on each system’s risk level. The same software can be high risk or limited risk depending on what you use it for.
First the inventory, then classification and gap analysis, and finally governance and the documentation each system needs according to its category.
| Risk level | Examples | Obligations | Applies from |
|---|---|---|---|
| Unacceptable (prohibited) | Subliminal manipulation, social scoring, certain biometric uses, sexual deepfakes | Total ban | Feb 2025 (sexual deepfakes: Dec 2026) |
| High risk | Recruitment, credit scoring, biometrics, education, AI in regulated products | Risk management, documentation, registration, human oversight, conformity assessment | Annex III: Dec 2027 · Annex I: Aug 2028 |
| Limited risk | Chatbots, assistants, generative AI, non-sexual deepfakes | Transparency: inform the user and mark the content | Aug 2026 (marking: Dec 2026) |
| Minimal risk | Spam filters, recommenders, video games, most uses | No specific obligations; voluntary good practices | — |
Calendar adjusted for the Digital Omnibus (agreement of May 2026, pending formal publication): the new high-risk deadlines take effect only after publication in the Official Journal of the EU. This page is for information only and is not legal advice; each system must be analyzed individually.
The postponement of high risk gives some breathing room, but it is no excuse to do nothing: the hard part is not the documentation template but finding and classifying all the AI in the organization. That can start now.
Your own, embedded and purchased systems, plus those your employees use on their own. Everything else depends on the inventory.
Obligations and deadlines depend on each system’s risk category. The same model changes category depending on the use.
Policies, human oversight and documentation. If you cannot show control, as far as the AESIA is concerned it is the same as not having it.
Want to build it into your compliance program? Look at it together with corporate compliance and the outsourced compliance officer.
Getting compliant with the AI Act is not signing a document: it is a process of inventory, classification and governance that must be demonstrable to the AESIA. Here is the route, from discovering which AI you use to sustaining the evidence over time.
1) InventoryWe map all AI systems: your own, embedded, purchased and the “shadow AI” employees use, with their purpose and the data they process.
2) ClassificationWe assign each system its level—prohibited, high, limited or minimal—and the company’s role: provider or deployer.
3) GapsWe compare each system with what the Regulation requires for its category and prioritize: what to withdraw, fix or document, and by when.
4) Governance + evidenceWe put in place the AI use policy, human oversight, Article 50 transparency and the documentation each system needs. And we leave the evidence ready to show compliance to the AESIA.
Quick decisionWithdraw or redesign it now: the Article 5 prohibitions have applied since 2025.
Documentation, registration and oversight; get ready for December 2027 / August 2028.
Transparency and marking of synthetic content from August / December 2026.
Know every AI system used or developed, including shadow AI.
Register of systems with purpose, data, role and provider.
Assign a risk level and a role (provider or deployer).
Classification matrix and justification for each system.
Disclose interaction with AI and mark generated or manipulated content.
Interface notices and machine-readable marking of synthetic content.
Risk management, data, human oversight, registration and conformity assessment.
Technical documentation, registration in the database and conformity assessment.
Align AI use with the GDPR and data subjects’ rights.
Legal bases, information to data subjects and coordination with the DPO.
Spot them before the AESIA does.
If you are bringing your company into line with the AI Regulation, these terms come up in classification, in documentation and in dealings with the AESIA.
Software that, with some degree of autonomy, generates outputs (predictions, recommendations, decisions, content) that influence its environment. It is the unit you inventory and classify.
Banned uses: subliminal manipulation, social scoring, certain biometric uses and sexual deepfakes. They cannot be offered or used. In force since February 2025.
Uses that affect rights or safety (HR, credit, biometrics, education). Enhanced obligations, with dates postponed by the Digital Omnibus.
Models such as those behind ChatGPT or Gemini, usable for many tasks. The main obligations fall on their provider; the user takes on transparency and, where relevant, high-risk obligations.
Disclose that people are interacting with AI and mark generated or manipulated content (including deepfakes). Not postponed: in force since August 2, 2026.
The provider develops or markets the system; the deployer uses it in its business. Each role has different obligations, and most companies are deployers.
AI market surveillance authority in Spain, based in A Coruña and the point of contact with the EU AI Office. It inspects and penalizes, including on its own initiative.
A space supervised by the AESIA where innovative AI systems—including high-risk ones—can be tested before launch, especially useful for SMEs and startups.
A machine-readable mark that identifies content generated or manipulated by AI, to tell the real from the synthetic. A provider obligation from December 2026.
Download the guide with the essentials for compliance: who is covered, the four risk levels, the calendar updated after the Digital Omnibus, the transparency obligations, the AESIA and the penalty regime.
Tell us which AI your company uses and we will tell you whether the AI Act applies to you, which risk level your systems fall into and what you need to do, with the updated calendar and the least possible effort.
The AI Act is Regulation (EU) 2024/1689, the world’s first comprehensive artificial intelligence law, in force since August 2024 and applying in stages. It takes a risk-based approach: it classifies systems into four levels and imposes proportionate obligations. In Spain, the market surveillance authority is the AESIA (Spanish Artificial Intelligence Supervisory Agency), based in A Coruña, which shares competences with the AEPD and sector supervisors. The penalty regime reaches €35 million or 7% of turnover.
The Digital Omnibus (political agreement of May 2026, backed by Parliament in June and pending formal adoption) postpones the high-risk obligations: those under Annex III to December 2027, and those under Annex I to August 2028. By contrast, the Article 5 prohibitions, the general-purpose model rules and Article 50 transparency (in force since August 2, 2026) are not postponed, and new prohibitions on sexual deepfakes are added, taking effect in December 2026. The new deadlines take effect only after publication in the Official Journal of the EU.
In May 2026 the Government approved the bill for an Organic Law for the proper use and governance of AI, which adapts the Regulation to Spanish law and sets the national authorities and penalty regime. It is still going through Parliament, but the substantive obligations are already enforceable through the EU regulation: the AESIA can issue warnings and inspect right now, so there is no point waiting for the law’s approval before you start complying.
You can consult the legislation and the competent authority at their official sources: the Regulation (EU) 2024/1689 (EUR-Lex) and the Spanish Artificial Intelligence Supervisory Agency (AESIA). This page is for information only and is not legal advice; each AI system must be analyzed individually.
Key legislation, linked to the official text:
Legislation and links reviewed in .